History

Commits on master to Source/Libraries/GSF.Web/Security/SessionHandler.cs18

GSF.Web: Improved operation session credential cache, including ability to disableJ. Ritchie Carroll committed 5 years ago9220975
GSF.Web: Updated primary login page to use post-based authentication This forces use and validation of anti-forgery tokensJ. Ritchie Carroll committed 5 years ago67449d2
GSF.Web: Added new AJAX header to allow for non-form based anti-forgery requests.J. Ritchie Carroll committed 5 years ago81c8600
GSF.Web: (1) Updated HtmlHelper anti-forgery functions to auto-derive request and response messages from instances available in RazorView ViewBag, (2) added generate and add extensions for request messages related to anti-forgery tokens, (3) added HttpMethods property to ValidatRequestVerificationTokenAttribute to control which HTTP methods validation should apply to since single controller methods can apply to multiple methods, default to all.J. Ritchie Carroll committed 8 years agof0a34e6
GSF.Web: Added operational anti-forgery code to self-hosted Owin web infrastructure derived from latest AspNetWebStack. Task primarily required changing code dependent on HttpContext to relevant HttpRequestMessage or HttpResponseMessage.J. Ritchie Carroll committed 8 years ago38385b3
GSF.Security: Fixed spelling of security context refresh event and made sure current user role gets included in security context data since user may not exist as a physical user in the user table but may be authorized anyway because of implicit rights via roles assigned to a group the user is a member of.J. Ritchie Carroll committed 8 years ago85a3606
GSF.Web: Minor code cleanup.J. Ritchie Carroll committed 8 years ago9d0c638
GSF.Web: Moved session last access updating to the top of the Owin pipeline to also include SignalR as a valid request for session persistence.J. Ritchie Carroll committed 8 years ago9ed8880
GSF.Web: Moved session state management and expiration checks from RazorView into SessionHandler so this processing is further up in the Owin pipeline - this way any authenticated request, API Controller / Razor / or otherwise, will contribute to session persistence.J. Ritchie Carroll committed 8 years ago39a8ae5
GSF.Web: Cleared release build warnings from SessionHandlerJ. Ritchie Carroll committed 8 years ago05e5f4c
GSF.Web: Implemented 'remember me' functionality for passthrough authentication in the web UI.StephenCWills committed 9 years agob2c784f
GSF.Web: Added a path to the session cookie to fix issues with authentication in Internet Explorer.StephenCWills committed 9 years agob2d9311
GSF.Web: Changed default session token to "x-gsf-auth" since session gets added automatically and used for other purposes by IE/EdgeJ. Ritchie Carroll committed 9 years ago4fd27cf
GSF.Web: Updated handling of anonymous and auth failure redirect resourcesJ. Ritchie Carroll committed 9 years agoffeb069
GSF.Web: Added Owin authentication middleware to use ISecurityProvider to authenticate a website.StephenCWills committed 9 years agoe919f69
GSF.Web: Updated session handler cookie lookup functions to return a GuidJ. Ritchie Carroll committed 9 years agoeb4aedc
GSF.Web: Updates to enable SignalR security pass-through.J. Ritchie Carroll committed 9 years agoeffb140
GSF.Web: Added session state handling to self-hosted web pages.J. Ritchie Carroll committed 9 years ago1775000